{"id":"CVE-2026-122192","kind":"vulnerability","aliases":["CVE-2026-122192"],"related":[],"title":"Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user…","description":"CVE-2026-122192: Guest Access to Firecracker Process Memory After a Failed Memory Discard\n\n### CVE-2026-122192: Guest Access to Firecracker Process Memory After a Failed Memory Discard\n\nBulletin ID: 2026-169-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/04/2026 11:30 AM PST\n\nDescription:\n\nFirecracker is an open source virtualization technology that powers AWS Lambda and other serverless compute services. We identified CVE-2026-122192, an issue in Firecracker v0.23.0 through v1.16.1 that, under certain host memory conditions, can let a root user in a guest read or modify memory of the Firecracker process. It affects VMs restored from a snapshot using the File memory backend with a balloon or virtio-mem device.\n\nAWS services including AWS Lambda are not affected by this issue. No customer action is required.\n\nImpacted versions: Firecracker v0.23.0 through v1.16.1, inclusive.\n\nWithin the currently supported release lines, v1.16.0 and v1.16.1 are affected. The fix is included in v1.16.2 and v1.17.0\n\nResolution:\n\nThis issue is fixed in Firecracker v1.16.2 and v1.17.0. If you restore VMs using the File memory backend with a balloon or virtio-mem device, we recommend upgrading to Firecracker v1.16.2, v1.17.0 or later. Operators maintaining forks or derivative code should incorporate the corresponding fixes.\n\nWorkarounds:\n\nIf upgrading is not immediately possible, restore snapshots using the Uffd memory backend, following its documented requirements for handling discarded pages.\n\nThe following measures address known host-memory failure conditions:\n\n- On kernels without the Linux 6.12 overcommit-handling change, use heuristic overcommit (vm.overcommit_memory=0) and keep the maximum discard size no greater than the host’s total RAM plus swap.\n- Keep the memory cgroup’s out-of-memory (OOM) killer enabled.\n\nThese measures do not prevent every replacement-mapping failure.\n\nReferences:\n\n- CVE-2026-122192\n- GHSA-48ww-rqpp-2mgm\n\nAcknowledgement:\n\nWe thank Juan Pablo Martinez Kuhn from Coinspect for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"Firecracker is an open source virtualization technology used by AWS Lambda. Under certain host memory conditions, a root user inside a guest VM restored from a snapshot can read or modify memory of the Firecracker process.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","firecracker","infrastructure","lab-disclosure","microvm","self-hosted"],"not_affected_if":["managed-hosting","no-balloon-or-virtio-mem","no-snapshot-restore","uffd-backend"],"how_to_check":"- Check the Firecracker version with `firecracker --version`; affected versions are `v0.23.0` through `v1.16.1`.\n- Check whether VMs are restored from snapshots using the File memory backend together with a balloon or virtio-mem device.\n- Check host overcommit with `sysctl vm.overcommit_memory` and the kernel version with `uname -r`.","fix":"- Firecracker `v1.16.2` or `v1.17.0` (or later).\n- Operators maintaining forks or derivative code should incorporate the corresponding fixes.","status":"open","published_at":"2026-11-04T20:19:12+00:00","first_seen_at":"2026-11-04T19:56:47+00:00","triaged_at":"2026-11-04T19:56:54+00:00","updated_at":"2026-11-04T20:40:33+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-04T19:56:54Z","model":"claude-haiku-5-5","output":{"fix":"- Firecracker `v1.16.2` or `v1.17.0` (or later).\n- Operators maintaining forks or derivative code should incorporate the corresponding fixes.","reach":"local","title":"Firecracker: guest root can read or modify host Firecracker process memory","impact":"high","summary":"Firecracker is an open source virtualization technology used by AWS Lambda. Under certain host memory conditions, a root user inside a guest VM restored from a snapshot can read or modify memory of the Firecracker process.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["firecracker","self-hosted","microvm"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Guest root reads or modifies the host Firecracker process memory","analyst_note":"","how_to_check":"- Check the Firecracker version with `firecracker --version`; affected versions are `v0.23.0` through `v1.16.1`.\n- Check whether VMs are restored from snapshots using the File memory backend together with a balloon or virtio-mem device.\n- Check host overcommit with `sysctl vm.overcommit_memory` and the kernel version with `uname -r`.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","uffd-backend","no-snapshot-restore","no-balloon-or-virtio-mem"],"who_is_affected":"Teams that run Firecracker microVMs themselves and restore VMs from snapshots using the File memory backend with a balloon or virtio-mem device. AWS states its own services, including Lambda, are not affected and need no customer action. Teams using the Uffd memory backend for snapshot restore are outside the stated scope.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000809,"input_tokens":4908,"output_tokens":636,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-122192':21A,24A,73C,87C,139C,367C '-169':102C '-2026':20A,23A,72C,86C,138C,366C '0':325C '0.23.0':11A '1.16.1':13A '11':114C '11/04/2026':113C '2026':101C '2mgm':372C '30':115C '48ww':370C '6.12':315C 'access':75C,89C 'acknowledg':373C 'action':202C 'address':303C 'affect':170C,196C,222C 'allow':15A 'attent':110C 'aw':25B,44B,103C,105C,128C,189C,192C 'aws-security@amazon.com':395C 'backend':180C,249C,291C 'balloon':183C,252C 'bulletin':99C 'certain':47B,149C 'cgroup':345C 'chang':319C 'code':272C 'coinspect':381C 'collabor':383C 'comput':133C 'concern':401C 'condit':50B,152C,309C 'content':106C 'coordin':389C 'correspond':276C 'current':214C 'custom':201C 'cve':19A,22A,71C,85C,137C,365C 'date':112C 'deriv':271C 'descript':118C 'devic':188C,257C 'discard':84C,98C,298C,330C 'disclosur':30B,391C 'document':294C 'email':394C 'enabl':353C 'everi':359C 'fail':5A,82C,96C 'failur':308C,363C 'file':178C,247C 'firecrack':9A,26B,35B,69B,77C,91C,119C,143C,167C,207C,237C,262C 'fix':224C,235C,277C 'follow':292C,301C 'fork':269C 'ghsa':369C 'ghsa-48ww-rqpp-2mgm':368C 'greater':333C 'guest':17A,56B,74C,88C,160C 'handl':2A,297C,318C 'heurist':321C 'host':34B,48B,150C,306C,336C 'host-memori':305C 'id':100C 'identifi':136C 'immedi':283C 'impact':205C 'import':108C 'improp':1A 'includ':191C,226C 'inclus':211C 'incorpor':274C 'infrastructur':27B 'insid':54B 'issu':141C,199C,233C,386C 'juan':376C 'keep':327C,342C 'kernel':311C 'killer':352C 'known':304C 'kuhn':379C 'lab':29B 'lab-disclosur':28B 'lambda':45B,129C,193C 'later':266C 'let':154C 'line':217C 'linux':314C 'maintain':268C 'map':362C 'martinez':378C 'maximum':329C 'measur':302C,355C 'mem':187C,256C 'memori':6A,49B,66B,79C,83C,93C,97C,151C,164C,179C,248C,290C,307C,324C,344C,350C 'microvm':31B 'might':14A 'modifi':65B,163C 'oom':351C 'open':38B,122C 'oper':267C 'out-of-memori':347C 'overcommit':317C,322C 'overcommit-handl':316C 'pablo':377C 'page':299C 'pleas':393C 'plus':340C 'possibl':284C 'power':127C 'prevent':358C 'process':70B,78C,92C,168C,392C 'pst':117C 'public':111C 'question':399C 'ram':339C 'read':63B,161C 'recommend':259C 'refer':364C 'releas':216C 'remap':7A 'replac':361C 'replacement-map':360C 'requir':109C,204C,295C 'resolut':231C 'restor':58B,172C,243C,285C 'root':52B,156C 'rqpp':371C 'scope':104C 'secur':398C 'self':33B 'self-host':32B 'serverless':132C 'servic':134C,190C 'size':331C 'snapshot':61B,175C,286C 'sourc':39B,123C 'support':215C 'swap':341C 'technolog':41B,125C 'thank':375C 'total':338C 'type':107C 'uffd':289C 'upgrad':260C,280C 'use':42B,176C,245C,287C,320C 'user':18A,53B,157C 'v0.23.0':144C,208C 'v1.16.0':218C 'v1.16.1':146C,210C,220C 'v1.16.2':228C,238C,263C 'v1.17.0':230C,240C,264C 'version':10A,206C 'virtio':186C,255C 'virtio-mem':185C,254C 'virtual':40B,124C 'vm':57B 'vm.overcommit':323C 'vms':171C,244C 'vulner':390C 'within':212C 'without':312C 'workaround':278C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Firecracker microVMs themselves and restore VMs from snapshots using the File memory backend with a balloon or virtio-mem device. AWS states its own services, including Lambda, are not affected and need no customer action. Teams using the Uffd memory backend for snapshot restore are outside the stated scope.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aws","firecracker","high","infrastructure","labdisclosure","microvm","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T19:37:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-169-aws/#CVE-2026-122192","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-169-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-04T19:56:47+00:00","fetched_at":"2026-11-04T19:56:47+00:00","note":"AWS: CVE-2026-122192: Guest Access to Firecracker Process Memory After a Failed Memory Discard"},{"source":"nvd","external_id":"CVE-2026-122192","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122192","severity":null,"published_at":"2026-11-04T20:19:12+00:00","modified_at":"2026-11-04T20:19:12+00:00","first_seen_at":"2026-11-04T20:29:03+00:00","fetched_at":"2026-11-04T20:29:03+00:00","note":null}],"documents":[{"id":69922,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-169-aws/","title":"AWS: CVE-2026-122192: Guest Access to Firecracker Process Memory After a Failed Memory Discard","kind":"advisory","source":"lab","publisher":"research","text":"CVE-2026-122192: Guest Access to Firecracker Process Memory After a Failed Memory Discard\n\n### CVE-2026-122192: Guest Access to Firecracker Process Memory After a Failed Memory Discard\n\nBulletin ID: 2026-169-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/04/2026 11:30 AM PST\n\nDescription:\n\nFirecracker is an open source virtualization technology that powers AWS Lambda and other serverless compute services. We identified CVE-2026-122192, an issue in Firecracker v0.23.0 through v1.16.1 that, under certain host memory conditions, can let a root user in a guest read or modify memory of the Firecracker process. It affects VMs restored from a snapshot using the File memory backend with a balloon or virtio-mem device.\n\nAWS services including AWS Lambda are not affected by this issue. No customer action is required.\n\nImpacted versions: Firecracker v0.23.0 through v1.16.1, inclusive.\n\nWithin the currently supported release lines, v1.16.0 and v1.16.1 are affected. The fix is included in v1.16.2 and v1.17.0\n\nResolution:\n\nThis issue is fixed in Firecracker v1.16.2 and v1.17.0. If you restore VMs using the File memory backend with a balloon or virtio-mem device, we recommend upgrading to Firecracker v1.16.2, v1.17.0 or later. Operators maintaining forks or derivative code should incorporate the corresponding fixes.\n\nWorkarounds:\n\nIf upgrading is not immediately possible, restore snapshots using the Uffd memory backend, following its documented requirements for handling discarded pages.\n\nThe following measures address known host-memory failure conditions:\n\n- On kernels without the Linux 6.12 overcommit-handling change, use heuristic overcommit (vm.overcommit_memory=0) and keep the maximum discard size no greater than the host’s total RAM plus swap.\n- Keep the memory cgroup’s out-of-memory (OOM) killer enabled.\n\nThese measures do not prevent every replacement-mapping failure.\n\nReferences:\n\n- CVE-2026-122192\n- GHSA-48ww-rqpp-2mgm\n\nAcknowledgement:\n\nWe thank Juan Pablo Martinez Kuhn from Coinspect for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":70204,"url":"https://github.com/firecracker-microvm/firecracker/releases/tag/v1.16.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":70205,"url":"https://github.com/firecracker-microvm/firecracker/releases/tag/v1.17.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":70206,"url":"https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-48ww-rqpp-2mgm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-04T19:37:39+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}